Some banks have asked core vendors to disable AI features, not due to risk assessments or board decisions, but to avoid triggering examination questions they were not prepared to answer.

Consider what that trade buys. The institution avoids a one-hour conversation. In exchange, it falls off the vendor's standard release track, runs an unpatched version, and accepts durable operational risk to escape temporary conversational risk. That is not caution; it is governance failure wearing caution as a disguise.

Executives widely believe the regulator is the obstacle to deployment. That belief is wrong and expensive. The real obstacle is that most institutions cannot produce evidence of decisions they have already made.

Examiners do not review your model

I spent my career on the supervisory side, first with the New York State Department of Financial Services (NYDFS), then as a senior information technology and cybersecurity examiner with the Office of the Comptroller of the Currency (OCC). Here is what executives should understand about how examination actually works.

An examiner does not evaluate whether your model architecture was well chosen, whether the return on investment justified the spend, or whether a different vendor would have served you better. Those are management and board decisions. Bringing an AI project into supervisory view does not invite an opinion on its merits; examiners have no mandate to render one.

What examiners evaluate is narrower and harder to fake. Did the institution follow the governance process it committed to in its own policies? Was there a documented decision, made by someone with authority, at a named point in time? If yes, and the paper aligns with stated commitments, the review is short. If the decision was made informally by people who understood the technology but never wrote anything down, the review is long, and the finding is about governance, not AI.

Institutions that treat every proposal as something a regulator might veto move slower than the standard actually requires. They are not being examined. They are examining themselves, badly, and calling it supervision.

There is no AI rulebook

The regulatory picture in 2026 makes this clearer. For fifteen years, United States banking model risk management anchored to SR 11-7 and OCC Bulletin 2011-12. On April 17, 2026, the OCC, the Federal Reserve Board, and the Federal Deposit Insurance Corporation (FDIC) replaced that framework with revised interagency guidance, issued as OCC Bulletin 2026-13, Federal Reserve SR 26-2, and FDIC FIL-15-2026.

Three features matter for AI deployment:

  • It is principles-based and non-enforceable. The agencies stated that it does not set enforceable standards and that non-compliance alone will not result in supervisory criticism.
  • It is scaled. The guidance is directed primarily at institutions above $30 billion in total assets, and scaled down for smaller institutions unless model risk is significant.
  • AI is carved out entirely. Generative and agentic AI are described as novel and rapidly evolving, and excluded from scope.

Institutions misread this carve-out. It does not mean generative AI is unsupervised. It means no dedicated framework governs it yet. The agencies have committed to a request for information covering model risk management and banks' AI use, including generative and agentic systems, but as of this writing it has not been issued.

The frameworks that apply today are general-purpose and sufficient: Bulletin 2026-13 for anything functioning as a model, OCC Bulletin 2023-17 for vendor-delivered solutions, the Federal Financial Institutions Examination Council Information Technology Examination Handbook for infrastructure, and for NYDFS-licensed entities, 23 NYCRR Part 500, reinforced by the October 21, 2025 industry letter naming AI providers as third parties covered entities must govern.

An institution waiting for a dedicated AI rulebook before building documentation discipline will still be waiting when its next examination begins. The examination will not be deferred.

What is genuinely new

AI raises real challenges, and neither panic nor dismissal is helpful. The hardest problem is not the model. It is the attestation chain behind it.

When a core platform ships AI features running on a foundation model built by someone else, your vendor is a third party. The model provider behind your vendor is a fourth party. You are accountable for the data handling and failure modes of a system two layers removed from anyone you have a contract with.

Vendors often withhold model-specific detail, leaving due diligence files thinner than examiners prefer. Institutions make an avoidable mistake here: they leave the gap silent, hoping it goes unnoticed. An acknowledged gap with a documented rationale for why the performed diligence was deemed sufficient holds up under examination. A silent one does not, because the finding then covers both the gap and the failure to identify it.

NYDFS anticipated this. Its October 2025 letter asks covered entities what practices their vendors use for selecting, monitoring, and contracting with downstream providers, and states that the Department will weigh the absence of appropriate third-party risk management in examinations, investigations, and enforcement actions. Who sits behind your vendor is already a supervisory question in New York.

Engaging a vendor never transfers regulatory responsibility. It relocates the documentation burden. Institutions that confuse these discover the difference at an inconvenient moment.

The question I was actually asking

In an exit meeting, the question is never whether the institution has an AI policy. Policies are cheap, and every institution produces one when asked.

The question is: who owns this use case, what did they decide, and when.

That question is difficult to answer not because governance is weak but because decisions were distributed. Someone in technology evaluated the capability. Someone in risk raised a concern resolved verbally. Someone in the business turned it on. Each acted reasonably. No single artifact records that any of it happened. From the outside, the institution cannot demonstrate it governed a decision it in fact governed carefully.

That is the entire gap: not missing controls, but missing evidence of controls that exist.

The fix is unglamorous and available now. Inventory where AI is actually running, including vendor-default features. Tier use cases by consequence, not technical novelty. Assign a named owner to each. Document the decision, the rationale, and the date. Brief the board on your existing governance cadence, not a special one invented for AI. Where diligence is thin, write down why it was deemed sufficient.

None of this requires new infrastructure. It requires the institution to do and record what its own policies already say it does. An institution that holds that discipline is examiner-ready by design rather than by scramble, and can deploy faster than competitors still waiting for permission that was never withheld.

Sources

Otuoze Baiye will discuss AI adoption and supervisory expectations with financial industry leaders at a fireside chat hosted by Coderio on August 26 at The Vault at Trinity Place in New York City. Registration inquiries: events@coderio.com.